Monday, January 1, 2007

Justice Dept. Database Stirs Privacy Fears - washingtonpost.com Size and Scope of the Interagency Investigative Tool Worry Civil Libertarians The Justice Department is building a massive database that allows state and local police officers around the country to search millions of case files from the FBI, Drug Enforcement Administration and other federal law enforcement agencies, according to Justice officials. The system, known as "OneDOJ," already holds approximately 1 million case records and is projected to triple in size over the next three years, Justice officials said. The files include investigative reports, criminal-history information, details of offenses, and the names, addresses and other information of criminal suspects or targets, officials said. [...] But civil-liberties and privacy advocates say the scale and contents of such a database raise immediate privacy and civil rights concerns, in part because tens of thousands of local police officers could gain access to personal details about people who have not been arrested or charged with crimes. The little-noticed program has been coming together over the past year and a half. It already is in use in pilot projects with local police in Seattle, San Diego and a handful of other areas, officials said. About 150 separate police agencies have access, officials said. But in a memorandum sent last week to the FBI, U.S. attorneys and other senior Justice officials, Deputy Attorney General Paul J. McNulty announced that the program will be expanded immediately to 15 additional regions and that federal authorities will "accelerate . . . efforts to share information from both open and closed cases." Eventually, the department hopes, the database will be a central mechanism for sharing federal law enforcement information with local and state investigators, who now run checks individually, and often manually, with Justice's five main law enforcement agencies: the FBI, the DEA, the U.S. Marshals Service, the Bureau of Prisons and the Bureau of Alcohol, Tobacco, Firearms and Explosives. Within three years, officials said, about 750 law enforcement agencies nationwide will have access. [...] Barry Steinhardt, director of the Technology and Liberty Project at the American Civil Liberties Union, said the main problem is one of "garbage in, garbage out," because case files frequently include erroneous or unproved allegations. "Raw police files or FBI reports can never be verified and can never be corrected," Steinhardt said. "That is a problem with even more formal and controlled systems. The idea that they're creating another whole system that is going to be full of inaccurate information is just chilling." Steinhardt noted that in 2003, the FBI announced that it would no longer meet the Privacy Act's accuracy requirements for the National Crime Information Center, its main criminal-background-check database, which is used by 80,000 law enforcement agencies across the country. 11:54:28 PM  PermaLink   / trackback []

OneDOJ to Offer National Criminal Database to Law Enforcement. OneDOJ to Offer National Criminal Database to Law Enforcement. Degrees writes "The Washington Post is reporting that the Justice Department is building a massive database, known as 'OneDOJ'. The system allows state and local police officers around the country to search millions of case files from the FBI, Drug Enforcement Administration and other federal law enforcement agencies. The system already holds approximately 1 million case records and is projected to triple in size over the next three years. The files include investigative reports, criminal-history information, details of offenses, and the names, addresses and other information of criminal suspects or targets. From the article: 'Civil-liberties and privacy advocates say the scale and contents of such a database raise immediate privacy and civil rights concerns, in part because tens of thousands of local police officers could gain access to personal details about people who have not been arrested or charged with crimes. The little-noticed program has been coming together over the past year and a half. It already is in use in pilot projects with local police in Seattle, San Diego and a handful of other areas, officials said.'" [Slashdot: Your Rights Online] 11:43:46 PM  PermaLink   / trackback []

Judge rules against Jennings, Democrats to seat Buchanan TALLAHASSEE -- A judge ruled Friday that congressional aspirant Christine Jennings has no right to examine the programming source code that runs the electronic voting machines at the center of a disputed Southwest Florida congressional race. Circuit Judge William Gary ruled that Jennings' arguments about the possibility of lost votes were "conjecture," and didn't warrant overriding the trade secrets of the voting machine company. Democrats in Congress meanwhile, said they'd allow Republican Vern Buchanan to take the seat next Thursday, but with a warning that the inquiry wasn't over and that his hold on it could be temporary. The state has certified Buchanan the winner of the District 13 race by a scant 369 votes. The ruling Friday from Judge Gary prevents for now the Jennings camp from being able to use the programming code to try to show voting machines used in Sarasota County malfunctioned. Jennings claims that an unusually large number of undervotes _ ballots that didn't show a vote _ recorded in the race implies the machines lost the votes. 11:40:28 PM  PermaLink   / trackback []

Source Code Access Denied in Disputed Race. Source Code Access Denied in Disputed Race. MrMetlHed writes "A judge ruled Friday that congressional aspirant Christine Jennings has no right to examine the source code that runs the electronic voting machines at the center of a disputed Southwest Florida congressional race. From the article: 'The ruling Friday from Judge Gary prevents for now the Jennings camp from being able to use the programming code to try to show voting machines used in Sarasota County malfunctioned. Jennings claims that an unusually large number of undervotes (ballots that didn't show a vote) recorded in the race implies the machines lost the votes.' " [Slashdot: Your Rights Online] 11:33:30 PM  PermaLink   / trackback []

The 10 most outrageous civil liberties violations of 2006. - By Dahlia Lithwick - Slate Magazine I love those year-end roundups--ubiquitous annual lists of greatest films and albums and lip glosses and tractors. It's reassuring that all human information can be wrestled into bundles of 10. In that spirit, Slate proudly presents, the top 10 civil liberties nightmares of the year: 11:10:50 PM  PermaLink   / trackback []

HD DVD's AACS Protection Bypassed. HD DVD's AACS Protection Bypassed. Mr. BS writes  "Playfuls.com is running a story how HD DVD's AACS protection has been compromised. Although the video of the hack leaves much to be desired, the source code has already been made available. Feel free to start backing up your HD DVD's whenever you feel the need."[Slashdot: Your Rights Online] 10:06:39 PM  PermaLink   / trackback []

Telegraph | News | US 'licence to snoop' on British air travellers Britons flying to America could have their credit card and email accounts inspected by the United States authorities following a deal struck by Brussels and Washington. By using a credit card to book a flight, passengers face having other transactions on the card inspected by the American authorities. Providing an email address to an airline could also lead to scrutiny of other messages sent or received on that account. The extent of the demands were disclosed in "undertakings" given by the US Department of Homeland Security to the European Union and published by the Department for Transport after a Freedom of Information request. About four million Britons travel to America each year and the released document shows that the US has demanded access to far more data than previously realised. Not only will such material be available when combating terrorism but the Americans have asserted the right to the same information when dealing with other serious crimes. Shami Chakrabarti, the director of the human rights group Liberty, expressed horror at the extent of the information made available. "It is a complete handover of the rights of people travelling to the United States," she said. 10:04:24 PM  PermaLink   / trackback []

Flying To the US? Pay In Cash. Flying To the US? Pay In Cash. pin_gween writes to point us to a report in the Telegraph that British travelers using a credit card to purchase their ticket may now have their credit card and email accounts inspected by US authorities. This has been true since October, when the US and the EU agreed about what information the US could demand from airlines and how this information would be handled. But details of the agreement only recently came to light following a Freedom of Information request. The US says it will "encourage" US carriers to reciprocate to any requests by European governments. From the article: "[T]he Americans are entitled to 34 separate pieces of Passenger Name Record (PNR) data... Initially, such material could be inspected for seven days but a reduced number of US officials could view it for three and a half years. Should any record be inspected during this period, the file could remain open for eight years...'It is pretty horrendous, particularly when you couple it with our one-sided extradition arrangements with the US,' said [a human rights activist]. 'It is making the act of buying a ticket a gateway to a host of personal email and financial information. While there are safeguards, it appears you would have to go to a US court to assert your rights.'" [Slashdot: Your Rights Online] 10:00:33 PM  PermaLink   / trackback []

Scientist Organizes Resistance To Polygraphs. Scientist Organizes Resistance To Polygraphs. George Maschke writes "Brad Holian, a senior scientist at Los Alamos National Laboratory, is using a blog to organize resistance to plans for random polygraph and drug testing of Lab scientists. Holian writes: 'Polygraphy is an insulting affront to scientists, since a committee of the National Academy of Sciences has declared that, beyond being inadmissible in court, there is no scientific basis for polygraphs. In my opinion, by agreeing to be polygraphed, one thereby seriously jeopardizes his or her claim to being a scientist, which is presumably the principal reason for employment for many scientists at Los Alamos.'" [Slashdot: Your Rights Online] 9:57:44 PM  PermaLink   / trackback []

Year-end 2006, Darknet Assumptions = True. Year-end 2006, Darknet Assumptions = True. Way back in November 2002, a set of Microsoft's senior-most security engineers wrote a paper that has come to be known as "the Microsoft Darknet Paper" (the company never endorsed it -- this was independent scholarship by the engineers). The paper explained why DRM for popular entertainment content would never work, so long as three assumptions remained true: 1. Any widely distributed object will be available to a fraction of users in a form that permits copying. 2. Users will copy objects if it is possible and interesting to do so. 3. Users are connected by high-bandwidth channels. As we ring in 2007, here are a few year-end stories that illustrate, yet again, that the Darknet Assumptions remain vividly, indisputably, true. Assumption #1: AACS DRM Cracked by BackupHDDVD Tool? All it takes is one leak, and DRM always leaks. Assumption #2: 2.6 billion blank CDs were sold in 2006, as compared to 588 million CDs of recorded music, says the Philadelphia Inquirer. By the end of 2006, Apple will have sold a total of approximately 80 million iPods. Audio and video features are now a standard feature on hard-drive enclosures and in network attached storage (NAS) solutions; in fact, inexpensive routers and NAS enclosures now include Bit Torrent clients, so that the downloading can continue, even when your computer is turned off. Assumption #3: A year-end review of trends in file-sharing, courtesy of Seattle Weekly, explains that users aren't just relying on P2P networks anymore, thanks to sharity blogs, YouTube (now downloadable, thanks to software tools), MySpace (again, downloadable), CD-Rs, and wireless sharing (ala Zune). And, according to Nielsen/NetRatings, 78% of Amercian Internet users now have high-speed connections at home, up from 65% in 2005. [EFF: Deep Links] 9:53:32 PM  PermaLink   / trackback []

IWF reforms could pave way for UK net censorship. IWF reforms could pave way for UK net censorship. Who is watching the watchers? Analysis By the end of 2007, the Home Office intends that all ISPs "offering broadband internet connectivity to the UK public" will have implemented systems for content blocking, primarily intended to block access to pornographic images of children, which are illegal to view or possess in the UK. [The Register - Internet and Law: Digital Rights/Digital Wrongs] 9:23:20 PM  PermaLink   / trackback []

QuickTime Flaw Kicks Off Month of Apple Bugs. QuickTime Flaw Kicks Off Month of Apple Bugs. A previously undocumented flaw in Apple's QuickTime media player could be exploited remotely by attackers to install malicious software on computers running either the Windows or Mac OS X operating systems, according to the inaugural posting by the Month of Apple Bugs project, a month-long effort that promises to feature a newly described security hole in Apple's software each day for all of January. The advisory on the MoAB page states that the vulnerability stems from the way QuickTime implements a media streaming communications standard known as the "real time streaming protocol," or RTSP for short. By convincing an unsuspecting user to click on a specially crafted, very long hyperlink that begins with "rtsp://", and an attacker could install unwanted software on the victim's computer. I am far from an expert on OS X, but the test exploit link I obtained from LMH -- the hacker handle of the secretive researcher who is co-curator of this project -- launched QuickTime on my test OS X Tiger system and then quickly crashed the application. When I manually re-launched QuickTime, it froze the entire computer, and the operating system threw up a message telling me that I need to restart. I learned later that the test exploit was written to work on Intel-based Macs, whereas my install of Tiger is on top of an older PowerPC. According to LMH, however, the exploit could also be made to work just as reliably on PowerPC based Macs. Johannes Ullrich, chief technology officer for the SANS Internet Storm Center, said the exploit appears to be fairly solid and easy to use, noting that its potential for abuse presents a serious security threat to both Windows and Mac users. "Apple [has] an advantage in that users typically do not run as administrators," Ullrich said. "But this still puts the user's personal data at risk." Threats more typically found on Windows machines, such as bot or keystroke logging programs, could be installed via this flaw even if a Mac user is running a less powerful user account, Ullrich said. LMH said the Windows and Mac QuickTime Version 7.1.3 and the Player Version 7.1.3 are vulnerable, and that earlier versions also are likely to be vulnerable. QuickTime users can mitigate the threat from this bug by not opening links that begin with "rtsp://" or by disabling the display of streaming files in QuickTime. To do that on a Mac, open QuickTime, go to "Preferences," then click on the "Advanced" tab. You should see a "Mime Settings" button; click on that, and then uncheck the box next to "Streaming - Streaming Movies." For Windows users of the most current QuickTime version, click on "Edit," then 'Preferences," and then "QuickTime Preferences". Click on the "File Types" tab, and then on the plus sign next to "Streaming - Streaming Movies" and uncheck the box next to "RSTP stream descriptor". I put in a query about this with Apple and will update the blog if I hear anything from them. I've been playing around with this RTSP protocol, and it appears as though in its default configuration, Firefox 2.0 doesn't know what to do with links that begin with "rtsp://" and will throw up an error message saying so if you try to visit such a link. However, Internet Explorer and Safari, the default Web browsers on Windows and OS X machines, respectively, will happily render them via QuickTime. I mention this because if the advisory is correct, this vulnerability does not strictly rely on tricking the would-be victim into clicking on a maliciously-crafted hyperlink. The exploit could be inserted into a video embedded in a Web page, one that loads automatically when the user visits the site. It also can be invoked inside of Macromedia Flash code or through Javascript commands (see the Security Fix post about the QuickTime worm on MySpace.com for a demonstration of the power of Javascript). [Security Fix] 9:18:54 PM  PermaLink   / trackback []